Intro to Cybersecurity

I am not watching YouTube because I want to present my screen. I'm also going to start recording this and I will post the recording later. But if you just joined five minutes in. That's what I thought. Okay, so I'm going to record. Don't mind me record on this computer. Let's do that. Okay. So I'm really, really excited about this, y', all, because I was not expecting to spend this much time writing up or drafting, writing a frickin PowerPoint, but I did. And it's because I think it's super. It's gonna be super helpful. So here we go. Give me a thumbs up when or like, or anything when you see this because I want to make sure everyone can see it. Actually, you know what, Before I do that, I can make sure that I'm seeing it online. So give me two seconds because the replay is 60 seconds behind. Okay, perfect. We can see it. Awesome. So if you are here, you are interested in cyber and honestly, like, I give you so many applause, so much applause for taking this first step because a lot of people can say that they're interested, but they don't do anything about it. And y' all have done something about it. So congratulations, you are here. I want to give you a pat on the back, a high five, whatever. You are awesome. You can do hard things, even though this isn't gonna be hard. So first I wanted to start with who's here. And for anyone that's just like joined, I want to say apologies again for the link situation. Hopefully more people are able to get on now. They probably noticed that something was already happening and actually let me go. And you know what, it's fine. I was going to say let me go and delete the old one so people aren't confused and we'll go to like figure out that it's on a different live. So let me go delete that old video that I just recorded because people will get confused if says there are 77 views already because people clicked on the link and we're going to delete it. That way if they like click on the link, they're going to like, what the heck, it's not here. Rather than it just being like a weird video, a weird video of me not doing anything. So let's just delete both. Delete forever. Yeah, that's that. Okay, so back to what we're talking about. Who's here in the comments, right? Where you're from, who you are, you know, the whole shebang. If you want to introduce yourself I want this to be a community of people that are getting into cyber and we'll talk about that later. That's the reason why I started this TikTok. That's the reason why I do what I do, reason why this is free. I spent so much time on this guys, but I want to create the best community of people. So who's here? Introduce yourself in the chat, even just say your name, you don't have to say your last name. Get to know people. And just for your reference, y' all like this, we got again 608 responses to this survey, which means 608 of y' all signed up for this class. And I know that there's not a lot right now. There was 77 on the first one that didn't work out. I think we're slowly going to start building as the time progresses, but just want you guys to realize that this class is for everyone. This course is for everyone. Anyone that's interested in cyber. You are not alone, first of all, and this course is for every type of experience level, whether you have none, which is the majority of you. And that's awesome that you're here. Whether it's basic, moderate or if you're considering, you consider yourself an expert. Like this course will help you understand all the different areas of cyber. So a lot of times people are like why would experts do this if you were trying to get into a new area and you just don't know where to start. Like this is a great place to start. And again this is based off of what you guys have commented and asked for on TikTok. And so yeah, we're going to get started. Just a quick about me. I hate doing about me by the way. Like I feel really uncomfortable. I feel like it's like me just telling you everything about my life but someone actually specifically requested it yesterday when I asked you guys to send your burning questions. So I'm going to go through quick about me section because I'm, I'm a very time oriented person and I know that I only want this to be an hour because I respect your time. So first things first, if you guys didn't know, I got my master's degree in mechanical engineering and my, I got my bachelor's degree in mechanical engineering and my master's in industrial systems engineering. I got into cyber really, really oddly. I decided I wanted to do technical consulting and I started applying to the big four for technical consulting. So all of the KPMGs, PwC, Deloitte, EY, I ended up going to EY and during my interview process for this specific reason, during my interview process at EY, this was 10ish years ago. @ this point, my recruiter was like, hey, would you ever be interested in cyber? We're looking to start building a team. We need staff members. We'll train you on the job. And I always am like, yes, let's learn why not. If I don't like it, I can always go to something else. So that's how I got into cyber. I first started with cyber transformation, understanding a very broad range of cyber. And then I really wanted to get deeper. So I started specializing in data protection and privacy like three years into my cyber career journey. And we'll go into all that later. But data protection and privacy is like something true to my heart. Basically, I help people protect their data and I help them abide by privacy laws and regulations. So quick about me super random. I mean I used to literally be an engineer. I worked in an oil refinery. I worked at GE and alternative energy. I worked as a supply chain engineer, like all before cyber. And I'm so, so glad I'm here and I'm here with you guys. So to fully understand what cyber security is, I just want to show you this diagram. So this diagram, FYI, was not created by me. That would have taken ages. But thank you to a man named Henry Jiang, and I might be butchering his name. He created this massive diagram. So this is what I love to show because there's so many ways of splitting cybersecurity up or putting things together and grouping them. Every company has their own ideas, their own language around cyber. They have their own teams that are kind of tweaked differently. So if you go to even the big four, no one's consistent with the way that they group cyber security, security kind of domains and topics. I think this is probably a very easy and clear way to show you that there's so many different areas in cyber and specifically I've broken out these areas from what I believe is non technical versus extremely technical. And we'll go through that later. But this is literally just to show you guys how like crazy and broad cybersecurity can be. And I realize it got dark real fast. It looks like I have no hair at this point. We're okay, we're going to continue. So I kind of circled the areas that I think are the most important. And again, this is just from my experience, my expertise from, yeah, just what I believe and what I've seen with other companies. And this is still not all of them. So just take it with a grain of salt. Like the way I'm grouping things, some people don't group it the same way. But I really want to show you because I think a lot of people right now when they're searching for jobs, just type in like cyber security job. And like that's not going to get you anywhere at this point because there's so many different areas of cybersecurity. Okay, so these are the domain areas that I broke it out into. Not in any order. Literally not at all. I didn't have time to rearrange it in the way I did it on the slide, but just to throw it out there, I broke it into 12, some people break it into 20, some people break it into 10, eight, whatever. And this doesn't really fully cover everything. Like I said, we can't cover all this. But I try to go like the extra like high level up so you can see what kind of is included in every single thing. And again, I talk a lot with my hands when I'm sitting down because I have so much energy. So yes, a lot of hands. A lot of hands. Okay, so I first wanted to start out with my favorite and the most, I think unpopular opinion on the Internet right now, non technical cybersecurity domains, which I consider I'm in. And I say this because I truly believe that as long as you're curious about certain areas of cyber, you really don't need to be that deeply technical in certain things. Yes, you might need to learn one or two technologies, but you don't need to be coding all the time. You're not hacking into systems, you don't need that technical ability. That's why I'm saying non technical. You still are going to need to learn how to use some technologies, etc. But some of these things, for example awareness and training. So I will preface this. Not a lot of companies have awareness and training, but I have ran into a few and I honestly think that more companies need to in the future because you're only as strong as your weakest link. So awareness and training, similar to HR people or cyber, a lot of this, a lot of times this groups into marketing. Your job is to help your company understand the importance of cybersecurity and how, and you're basically allowing or showing them how their actions affect the entire company. So not clicking on phishing emails, not having, you know, easy guessable passwords, ultimately you're helping your company protect itself, but you're also teaching your own. So first, quick kind of intro on how I've laid this out. So with every single section I have the domain title, I have a description, description of what it is, the skills I think are required for this type of job and then some potential helpful certifications. Because again, I get three questions every time I'm on TikTok. Those three questions are how do I get into cyber? How do I get a job? What certifications do I need? And every single time people ask me that I say what domain are you going into? Because every domain is different, every area of cybersecurity is different. There are literally specific certifications for specific things. So that's why I broke it out like this, to give you a general understanding of what each thing is, the skills required. So if you're like looking into like, oh my, I might do this, like do I have these skills? And then if you're really interested in it, some certifications that you might consider taking to get into this. And again, I want to preface, awareness and training is really not a big one, but I personally believe it is. So people might come at me saying awareness and training is not like its own domain, but through NIST and ISO which are like very well known global cybersecurity certifications, they assess on this, it's one of their domains too. So you might not have a full team around it. But I wanted to include that in there. The other thing I did for each domain is talk about the potential job responsibilities you have. So this is might be something that's pulled from like LinkedIn. Like I did pull some of these from LinkedIn because it's like what you will be doing on a day to day basis. Just to give you a general idea of like, oh, if I get into awareness and training this is what I would have to do. So hopefully that helps. And I'm doing this for every domain so you don't have a lot of time. I'm going to try to go through each one like three or four minutes. Okay, potential job responsibilities, awareness and training, which one is to own, develop, mature, like sustainable training and awareness program. And it sounds really low key but again some of the companies I work with, like the large companies, have entire training programs, like an annual program where they have incentives for their, you know, their staff, et cetera. Like this can be a very large task. You're also defining the guidelines that must be followed for all staff. So this includes like, you know, the intro training on, you know, how to protect your IT and everything like that. You're in charge of Everything. Understanding and awareness. It's not just like an actual training module. You could be, you know, helping with phishing incidents, all that stuff. So it's a big responsibility. But a lot of times companies don't see it like that. So there's not a lot of specific. The next one is audit. Tons and tons, cybersecurity audit. Specifically because we are going through cybersecurity. So for those of you that don't know what audit is, it's a team that basically like it's. Well, we're going to really specifically speak about internal audit. So I should have put internal. But you're helping your company review and analyze your infrastructure and your cybersecurity and you're identifying threats and vulnerabilities. So usually what happens is you take a standard like, like ISO 2701 or NIST, which are all cybersecurity standards, and you kind of audit yourself. You compare yourself against those standards and they're like long, long standards. Like audits can take months and then from there you can identify your areas of strengths and your areas of weakness and what you think. And you basically communicate to your company, oh, in this one area we're actually really forming, not strong. So in training and awareness, we're not doing enough. Our people don't know how to blank. So auditing is super, super important. Especially now when there's, you know, private data privacy laws. A lot of people, when they go internationally, they want to get certain cyber security certifications, otherwise big companies won't work with them. So you're always auditing. It's usually internal audit yourself. There is a specific cyber certification for this called the cisa. Cyber Information Security Auditor. Or I think it's. Why did I say cyber? I think it's cybersecurity Information Security auditor. Could be computer, I don't know, brain fart. Anyways, look up the cisa. It's a very well known and it's literally all about auditing. So some potential job responsibilities. Again, you're developing your company's internal audit strategy, which means like you have a timeline. Again, audits can be long, short. If you're doing all the internal audits for cybersecurity, there are multiple audits. You have to develop a strategy, a timeline, you have to design. You have to understand who you need to talk to understand the key players. Develop and coordinate testing. Like auditing is not just like check the box, you have to like test certain things too. If you need to conduct investigations, you have to work with other teams, review companies, business Processes like review policies and procedures, making sure that everything's up and running correctly. Okay, Data protection and privacy. This is my favorite because I'm in it. So the easiest way to describe data protection and privacy is basically protecting your company's crown jewels from corruption, compromise and loss. So, so I. E. The best example of doing this is Coke, right? Coke wants to guard their formula for everything like they do not. If anyone gets a hold of the Coke formula, they're done. They're just going to be remade. So the crown jewels could be their formula. There are other crown jewels too now that are considered like personal information because if you lose personal information, you can get a big lawsuit and you lose your reputation, like a bad reputation. So a lot of other things, but that's like the main goal of data protection and privacy is also to be abide by data privacy laws which have come up a lot in the last five plus years. Prime example, GDPR in the uk, CCPA in California. If you don't know any of these, look them up. But it allows users to basically have more ability or I guess I'm having a brain fart, but it allows us as like users of websites to have more say in what they do with our data. There we go. The skills required, any understanding of any like data protection related regulations and laws. Again, all this stuff, you don't need to be a lawyer. There are a lot of lawyers now in data privacy and protection, but you don't need to be a lawyer. All this stuff again is in my opinion non technical. There are, yes, there are data loss prevention tools that you might need to learn how to use, but we all know how to use tools. It's like learning a new technology. You learn how to use a new computer, you learn how to use a new phone. We're all learning helpful certifications for this. Anything from the iapp, which is the International association of Privacy Professionals. So there's a CIPP us, there's cipt, there's a lot of them. Do your research. Those are the best ones. If you want to get into this, this is what I'm in. So some of the job responsibilities are manage DLP tools, which is a data loss prevention tool, work with governance, risk and compliance and legal to write appropriate privacy policies and work with other cybersecurity teams, confirm appropriate safeguards are in place to actually manage.